diff --git a/src/main.rs b/src/main.rs
index bc05041..b67445a 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -75,7 +75,7 @@ async fn main() -> std::io::Result<()> {
 					.header("X-Frame-Options", "DENY")
 					.header(
 						"Content-Security-Policy",
-						"default-src 'none'; style-src 'self' 'unsafe-inline'; base-uri 'none'; img-src 'self' data:; form-action 'self'; frame-ancestors 'none';",
+						"default-src 'none'; media-src 'self'; style-src 'self' 'unsafe-inline'; base-uri 'none'; img-src 'self' data:; form-action 'self'; frame-ancestors 'none';",
 					),
 			)
 			// Default service in case no routes match
diff --git a/src/subreddit.rs b/src/subreddit.rs
index dbd5f94..7aac494 100644
--- a/src/subreddit.rs
+++ b/src/subreddit.rs
@@ -44,7 +44,7 @@ pub async fn page(req: HttpRequest) -> HttpResponse {
 			front_page.to_owned()
 		});
 
-	let path = format!("/r/{}.json?{}", sub, req.query_string());
+	let path = format!("/r/{}/{}.json?{}", sub, sort, req.query_string());
 
 	match fetch_posts(&path, String::new()).await {
 		Ok((posts, after)) => {